I have Snort shoving JSON logs to Splunk, I see everything just dandy when I do the following in search:     sourcetype="snort3:alert:json"     I see many events! However, I can have to create alerts based on suspicious activities that I already search for in Splunk. Is there some way to load pre-set common alerts into Splunk?  Do I have to go through the task of making each alert for Splunk (eg: create alert for bad RDP logins, lengthy ICMP probes, bad FTP logins, etc.. etc..?)  I guess what I'm asking is there a way to make my Splunk populate alert rules that are predefined or are zero day? ... View more